Jan/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restricted SSH access

Browse Source
This commit is contained in:
Jan-Bulthuis 2025-05-30 16:15:52 +02:00
parent 46fe5b8056
commit 0cf53a97cf
1 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
modules/nixos/ssh.nix
View File

@ -9,19 +9,24 @@ in
enable = mkEnableOption "ssh";
};
config = mkIf cfg.enable {
services.openssh.enable = true;
# TODO: Is this default configuration secure?
services.openssh.hostKeys = mkIf (config.modules.impermanence.enable) [
{
type = "ed25519";
path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
}
{
type = "rsa";
bits = 4096;
path = "/persist/system/etc/ssh/ssh_host_rsa_key";
}
];
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
hostKeys = mkIf (config.modules.impermanence.enable) [
{
type = "ed25519";
path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
}
{
type = "rsa";
bits = 4096;
path = "/persist/system/etc/ssh/ssh_host_rsa_key";
}
];
};
};
}